India’s DPDP clock is running. Build before May 2027.

The phasing, and what is already live

The Rules were notified on 13 November 2025. Provisions setting up the Data Protection Board of India, the regulator that will hear complaints and impose penalties, took effect immediately.

The consent manager framework is scheduled for 13 November 2026, about twelve months after notification. The core obligations follow around 13 May 2027. Until then most duties are not enforceable, but contracts, product roadmaps and vendor choices you make now will decide whether you are ready.

• 13 November 2025: Rules notified; Data Protection Board provisions in force
• 13 November 2026: consent manager registration and obligations
• 13 May 2027: notice, consent, security, breach intimation, rights, retention, children’s data and Significant Data Fiduciary duties

Who is in scope, including global companies

The Act uses its own vocabulary. A “data fiduciary” is the business that decides why and how personal data is processed, much like a controller under the GDPR. A “data principal” is the person the data is about. A “data processor” processes data on the fiduciary’s behalf, such as a cloud or CRM vendor.

The Act covers digital personal data, including data collected offline and later digitised. For foreign companies, the test is whether processing is connected with offering goods or services to people in India. If you have an Indian pricing page, an Indian app store listing or rupee payments, assume you are in scope.

If you already comply with the GDPR, you have a head start on inventories and security. But the DPDP Act is not a copy. It relies more heavily on consent, has fewer lawful bases and treats everyone under 18 as a child.

Consent is a product surface

Under the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. The Act also allows a short list of “legitimate uses” without consent, such as data a person voluntarily provides for a specified purpose, but most consumer businesses will rely on consent for much of their processing.

The notice that accompanies consent must stand on its own. It must give an itemised description of the personal data and the purposes, be understandable without reading other documents, and be available in English or any language in the Eighth Schedule to India’s Constitution. A pasted GDPR privacy policy will not meet this test.

Withdrawing consent must be as easy as giving it. If sign-up takes one tap, opting out cannot require an email to support. When consent is withdrawn, processing must stop within a reasonable time, and your processors must stop too. That makes consent a data-flow problem, not just a screen design problem.

Consent managers arrive in November 2026

A consent manager is a registered intermediary that lets people give, manage, review and withdraw consent across many businesses from one platform. Under the Rules, consent managers must be Indian companies with a net worth of at least ₹2 crore and must register with the Data Protection Board.

You are not required to use a consent manager. But if your users start managing consent through one, your systems need to accept and act on those signals. Decide in the coming months whether you will integrate, and ask your consent management vendor what its roadmap looks like.

Children change the architecture

The DPDP Act defines a child as anyone under 18, which is higher than the thresholds in many other countries. Processing a child’s personal data requires verifiable consent from a parent or lawful guardian. Tracking, behavioural monitoring and targeted advertising directed at children are not allowed.

The Rules exempt certain classes of businesses, such as some healthcare and educational providers, for limited purposes. For most consumer apps, though, if minors use or are likely to use the service, you need age signals and a parental consent flow. These are design decisions with knock-on effects for analytics, advertising and growth, so make them early.

Security, breaches and retention

Data fiduciaries must take reasonable security safeguards. The Rules describe a baseline that includes encryption or similar measures, access controls, monitoring and logs, and backups. Logs and related data are expected to be kept for at least one year, so check your logging retention settings.

If a personal data breach happens, you must inform the Data Protection Board and each affected person without delay. The Rules then require a detailed report to the Board within 72 hours, unless the Board allows longer. If you also fall under CERT-In’s directions, certain cyber incidents must be reported to CERT-In within six hours, which is a separate clock.

Data must be erased once the purpose is served or consent is withdrawn, unless the law requires you to keep it. For large e-commerce, online gaming and social media platforms, the Rules set a three-year inactivity period, after which data must be erased, with 48 hours’ notice to the user first.

Rights, grievances and Significant Data Fiduciaries

Data principals can ask for a summary of their data and who it has been shared with, and can request correction, completion and erasure. They can also nominate someone to exercise their rights on death or incapacity. You must publish how to make requests and run a grievance process, and the Rules set an outer limit of 90 days for responding to grievances.

The government can designate some businesses as Significant Data Fiduciaries, based on factors such as the volume and sensitivity of data and risks to people. They carry extra duties, including a Data Protection Officer based in India, an independent data auditor, and periodic data protection impact assessments and audits.

Penalties concentrate attention

The Act’s Schedule sets maximum penalties per breach. Failing to take reasonable security safeguards can cost up to ₹250 crore. Failing to notify a breach, or breaching the rules on children’s data, can each cost up to ₹200 crore. Failing in Significant Data Fiduciary duties can cost up to ₹150 crore, and other breaches up to ₹50 crore.

Security is both the most expensive failure and the one that takes longest to fix. Treat security and breach readiness as the first workstream, not the last. Consent redesign comes a close second, because it touches every product team.